As a child, I used to be haunted.

I’d open my eyes in the middle of the night to the room shaking, a heavy weight pressed against my chest, and pillows being yanked from beneath my head. Sometimes the lights would flicker. Other times, things in the room would move.

I’d try to raise my arms. My body wouldn’t respond. When I tried to scream, my voice would emerge as a croak. The old digital clock beside my bed would flash 12:00 repeatedly, like an angry eye blinking in time with my terror.

In my superstitious childhood mind, there was only one explanation: a poltergeist. I’d seen the movie far too young. If something was moving around my bedroom while I lay helpless, surely it came from the other side of normal.

The haunting followed me into adulthood.

Eventually, after a keynote, I met a neurologist who helped explain what had been happening to me for decades. It had a name: sleep paralysis.

During REM sleep, the body normally suppresses most voluntary muscle movement. Occasionally, awareness returns before that temporary paralysis ends. You wake up, recognize your bedroom, and try to move—but your body hasn’t caught up. Dreamlike images and sensations can follow you into that moment. Here’s the medical explanation.

For me, they tend to be frighteningly supernatural.

Knowing the explanation hasn’t made those episodes much less terrifying. The only thing I’ve found that reliably helps me avoid them is to never, ever, sleep on my back.

But the part that follows me past the weirdness is not the imagined ghost. It’s the helplessness.

My eyes are open. I know something is wrong. I want to act. And nothing responds.

I imagine there was a version of that terror inside Binance as the scale of its cyberattack became clear. Billions of dollars in token assets gone. Real people’s money. An emergency that no one could end by reaching for a light switch.

We don’t yet have the full account of what its security team saw, when they saw it, or how they fought to stop it. But imagine confronting that loss while racing to discover whether the intruders still had another way in.

With sleep paralysis, I can at least tell myself that the things moving around my room aren’t real. Eventually, my body will wake up. The terror will pass.

For the people responding at Binance, waking up offered no such escape. The missing billions would still be missing.

The nightmare had become very real.

According to Binance, its hot wallets were compromised on October 29, resulting in approximately $6.3 billion in lost token assets. Its initial investigation pointed to a possibly compromised laptop. Further investigation uncovered additional breach points. The company says the investigation remains ongoing. Read Binance’s incident update.

That leaves us with a frightening number and an incomplete explanation.

A laptop makes the story feel familiar. You probably have one within arm’s reach. But until investigators establish the attack sequence, we cannot say exactly how access became unauthorized withdrawals.

What we can do is examine the distance between those two things in our own organizations.

If someone takes over an employee’s device, what happens next? Can they initiate a payment? Change its destination? Approve their own request? Disable the control that would have stopped them?

Those are questions to ask before the screen starts showing transactions nobody recognizes.

Binance’s November 1 recovery update says withdrawals are returning in phases and approximately 95% of the affected amount has been covered using company resources. That is replenishment, rather than a claim that 95% of stolen assets have been recovered. Binance also says it will bear the financial impact and publish a post-incident report after completing its investigation. Read the recovery update.

Restoring access is obviously the most important issue for customers. Understanding how the attack succeeded is critical to prevent the next one.

The lesson I’m drawing is broader than this unfinished investigation: security needs a way to interrupt a dangerous action even after someone gets through the door. As I say in my new book Spies, Lies, and Cybercrime: we need to hunt the threat before the threat hunts us.

During sleep paralysis, willing my arm to move accomplishes nothing. An organization can experience its own paralysis when everyone recognizes an emergency but nobody knows what to do about it.

You can rehearse your way out of that uncertainty.

Choose one consequential action: a wire transfer, a payroll-account change, a production deployment, or a large withdrawal. Then walk through four checks.

Try this question at your next leadership meeting:

“If a fraudulent payment were leaving right now, who could stop it—and how would we reach them?”

Keep going until someone can describe the actual steps.

The goal is to make action possible when fear and uncertainty arrive together.

My childhood nightmare involved an unseen presence in a familiar room.

The remote-work fraud described in a recent Justice Department case has its own unsettling version of that idea: familiar equipment, an apparently legitimate identity, and someone else operating from a distance.

John Allen Kurrle Jr. pleaded guilty to conspiracy to commit wire fraud after participating in fraudulent remote-employment applications. According to DOJ, he allowed his identity to be used, received employer-issued laptops at his Virginia home, and handed over remote access to criminals outside the United States.

Applications using his identity or a stolen identity induced nine job offers.

DOJ describes the case much like North Korean IT-worker schemes that use U.S.-based facilitators to host employer equipment. Worse, Kurrle was a defense-contractor employee with a security clearance! Read the guilty-plea announcement.

For employers, the uncomfortable question is straightforward: Who is actually behind the keyboard?

A successful hiring process should begin an ongoing relationship of verification. HR, IT, and security need a shared way to investigate discrepancies involving identity, equipment delivery, remote access, and unexpected changes in working arrangements.

Otherwise, separate departments might each hold a critical clue that an employee is fraudulent while nobody sees enough to act.

If you enjoyed this week’s newsletter, you’ll find even more inside my new book, SPIES, LIES, AND CYBERCRIME. Drawing on my years hunting spies for the FBI, it reveals how espionage, cybercrime, and AI-powered deception intersect—and what you can do to stay one step ahead.

Ready for the next mission?

Already read the book? A quick review on Amazon or Goodreads helps more readers discover it. Thank you for your support.

There is another way to make a victim helpless: block their escape.

A joint advisory from the FBI, CISA, and Secret Service says SafePay ransomware actors have affected at least 600 victims since August 2024.

The advisory describes actors encrypting files and disabling services designed to assist recovery. Read the SafePay advisory.

Imagine opening a folder and finding that every file is still there—but nothing opens.

Your contracts. Your customer records. Familiar filenames, suddenly useless. You click again.

Then you find the ransom note.

Someone else controls the key to your work. They want you frightened enough to pay to get it back.

You reach for the backups. That’s when the nightmare gets worse: the attackers have gone after your way out, too.

This is paralysis. You recognize the room. But you cannot make it respond.

Encryption puts files beyond your reach. Deleted or disabled recovery options can make that helplessness last. The pressure comes from everything those files support: employees waiting for instructions, customers waiting for answers, a business trying to function without its own memory.

Before that happens, make your team prove it can recover.

Pick something the business needs. Restore it somewhere isolated. Find out whether recovery depends on a password, an account, or a system an attacker could also take away.

Keep recovery copies protected from the accounts that run your everyday systems. Use encrypted cloud environments or air gap the backups so the bad guys can’t reach them.

When a ransom note appears, you want someone in the room who can say, “We’ve practiced this. Here’s how we get our work back.”

Please support those who keep this newsletter free with a click!

Most people who read Atomic Habits remember one line: small habits compound. Here's the rest worth keeping:

Shortform breaks down books like Atomic Habits into the key ideas, the reasoning behind them, and how to put them to work. This one takes about 15 minutes.

Then do the same for the next book on your list.

Start learning!

If someone forwarded you this newsletter, join more than 5,500 readers every Tuesday for practical lessons from the worlds of espionage, cybercrime, artificial intelligence, and the human stories behind them.

I still dread opening my eyes and discovering that I cannot move.

In cybersecurity, we have opportunities to prepare for that feeling: limit what one compromised account can authorize, connect the people who hold different warning signs, and practice restoring what an attacker might destroy.

This week, choose one scenario to test and give yourself a way out when the emergency arrives.

Stay safe out there and keep thinking like a spy hunter.

Praemonitus Praemunitus!

Forewarned is Forearmed!

~Eric